helpGnuTLS - Support: sr #107932, Cannot initialise AES-256-PGP-CFB...

 
 

sr #107932: Cannot initialise AES-256-PGP-CFB cipher support in GnuTLS 3

Submitted by:  None
Submitted on:  Thu 12 Jan 2012 05:22:51 PM UTC  
 
Category: Core libraryPriority: 5 - Normal
Severity: 3 - NormalStatus: Wont Do
Privacy: PublicAssigned to: Nikos Mavrogiannopoulos <nmav>
Originator Email: -unavailable-Open/Closed: Open
Operating System: GNU/Linux

Add a New Comment (Rich MarkupRich Markup):
   

You are not logged in

Please log in, so followups can be emailed to you.

 

Thu 12 Jan 2012 06:32:33 PM UTC, comment #1:

Hello,
You are right. This cipher is not supported in GnuTLS 3 and there no plans to add it anytime soon (because it is not needed for TLS). Those ciphers are listed to read the cipher on encrypted openpgp packets, and is currently unused.

I'll modify gnutls_cipher_list in order not to print those.

Unfortunately I have to tag this as wont fix.

Nikos Mavrogiannopoulos <nmav>
Project AdministratorIn charge of this item.
Thu 12 Jan 2012 05:22:51 PM UTC, original submission:

Hullo,

I am having problems trying to initialise a cipher handle for AES-256-PGP-CFB using GnuTLS 3.0.11 and keep getting an error string of "The request is invalid" when calling gnutls_cipher_init. I'm aware that GnuTLS 3 has been migrated away from gcrypt to nettle, so I went looking in the docs for nettle, and found no mention of any support for ciphers in CFB mode. This led me to dig further into the GnuTLS source to see if the CFB ciphers were actually implemented.

As far as I can tell, there are two ways in which a cipher can be implemented: either a specific accelerated implementation is registered using _cipher_register during global initialisation, or _gnutls_cipher_init falls through to the "generic" cipher ops, which eventually falls through to wrap_nettle_cipher_init in lib/nettle/cipher.c. The latter function doesn't have cases to handle any of the -PGP-CFB ciphers, so if I am correct, these ciphers are completely unavailable in GnuTLS as I have compiled it.

Is this correct, and how should I go about using these ciphers with GnuTLS 3? I am trying to drop my code's explicit dependency on gcrypt, since GnuTLS itself no longer depends on it.

Note also that AES-256-PGP-CFB does appear in the output of gnutls_cipher_list, but from looking at the code, that just iterates over the list of defined ciphers - which does not guarantee an implementation exists for any particular cipher in the list.

Anonymous

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach File(s):
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by nmav (Posted a comment)
  • -unavailable- added by None (Submitted the item)
  •  

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follow 3 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Thu 12 Jan 2012 06:32:33 PM UTCnmavCategoryNone=>Core library
      StatusNone=>Wont Do
      Assigned toNone=>nmav

    Back to the top


    Powered by Savane 3.1-cleanup